   (revoke-all! *token-store* key))
 
 (defn revoke-token
-  "Revokes previously generated token based on its secret. "
+  "Revokes existing token. Refresh tokens are removed along with all
+  access tokens bound to the same client-user pair."
   [token]
   (let [{:keys [client-id login secret refreshing]} token]
 
-    ;; when refresh token is removed, corresponding
-    ;; access-token and grant alias should be removed as well
+    ;; when refresh token is removed,
+    ;; all corresponding tokens should be removed as well
 
     (revoke-one! *token-store* [client-id "access" (or refreshing secret)])
 
     (when refreshing
       (revoke-one! *token-store* [client-id "refresh" secret])
-      (revoke-one! *token-store* [client-id "grant" login]))))
+      (revoke-one! *token-store* [client-id "login" login]))))
 
 (defn create-token
   "Creates new token"

               (first (condp = tag
                        "access"  (db/find-access-token {:client-id client-id :secret arg})
                        "refresh" (db/find-refresh-token-by-secret {:client-id client-id :secret arg})
                        "grant"   (db/find-refresh-token-by-login {:client-id client-id :login arg})))]

      {:client-id client_id
       :user-id user_id


    (if (f/failed? access-token)
      access-token
      (let [refresh-token (or (find-granted-token (:id client) (:login user))
                              (create-token client user scope {:refreshing secret}))]

        (-> {:access_token secret
